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1.0 INTRODUCTION 


The purpose of this report is to present the bindings of a study directed 
to the establishment of guidelines for the development of consumables subsystem 
redlines for advanced spacecraft systems. Although the basic redline function 
remains unchanged, the methodology employed in past programs is inadequate to 
support future spacecraft requirements. Techniques developed for the Apollo 
missions, for example, characterized by the developmental nature of each of 
its flights, must be reoriented to serve the needs of the highly repetitive 
and routine earth orbit operations of the advanced spacecraft systems. 

The report is structured to present general Iredline concepts (Section 2.0) 
with a twofold purpose. The first is an attempt to establish general redline 
criteria; the second, to establish the basis for the evaluation of work per- 
formed in past programs in order to fully utilize those aspects applicable to 
advanced systems. 

Section 3.0 presents a summary of the redline activity of past programs 
including development, implementation, and monitoring functions. 

Requirements of the operational Space Shuttle spacecraft as an example 
of an advanced spacecraft system are included in Section 4.0. These require- 
ments, especially the projected high flight density, strongly suggest the 
development of simplified methods that would be both responsive and cost 
effective in the new operating environment. Guidelines for the redline de- 
velopment process of the Space Shuttle are presented, and implementation of 
the function of a Redline Status Subprocessor is recommended as a substi- 
tute for the methods employed in past programs. The algorithms of the 
Redline Status Subprocessor are amenable for use in the Mission Control 
Center (MCC) at Johnson Space Center (JSC), the Launch Processing System 
(LPS) under development at the Kennedy Space Center (KSC), or the Space 
Shuttle onboard computer system. 


2.0 GENERAL REDLINE CONCEPTS 

2.1 REDLINE DEFINITION 

A redline is that maximum or minimum limit that defines the safe opera- 
ting range or condition of a given system. Primary factors that dictate the 
establishment of redlines include personnel safety and/or equipment protection. 
Secondary considerations not directly related to either personnel safety or 
equipment protection but influencing the attainment of specific objectives 
dictate the establishment of redlines to the extent required to ensure the 
achievement of these goals. Consequently, operation of a system outside the 
redline limit will result in serious personnel injury, severe equipment 
damage, or failure to achieve specific objectives. 

Redline values must represent realistic limits that effectively protect 
the system without restricting its operation. As a rule, redline violations 
are associated with an impending equipment or process failure and therefore 
are characterized by a definite response that must follow any limit violations. 
This action corresponds to: a) a preplanned course of action designed for the 
control and possible recovery from the situation giving rise to the violation; 
or b) the deleterious consequences ensuing if the violation is either undetected 
or ignored. 

2.2 REDLINE SPECIFICATION 

In the context of the given redline definition, limits can be specified 
as absolute or time dependent values. Absolute value redlines, although not 
restricted to, are used primarily for the control of two functions. First, 
they define a preconditional limit that must be met prior to the initiation 
of a given process or mechanism. Secondly, they define that absolute limit 
that may not be violated after the process has been initiated. Time dependent 
redlines are used to define a continuous limit that varies as a function of 
time for the duration of a process. 

2.2.1 Absolute Value Redlines 

Establishment of absolute value redlines although ultimately directed 
for the protection of life and equipment are principally associated with the 
fulfilling of specific objectives. When specified as a precondition for a 
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process initiation, their observance relates to the degree to which goal 
achievement can be compromised. An aircraft traveling non-stop from point 
"A" to point "B" for example, must be loaded with a minimum fuel quantity 
"Q" sufficient to complete the trip. Thus, the absolute value of "Q" con- 
stitutes the redline which is designed to ensure the completion of the non- 
stop flight. Therefore, the trip may not be initiated with a fuel quantity 
less than "Q" if it is to be completed in the specified manner. 

The redline specification process requires in addition to the limit 
value itself additional information which is used to aid in the decision 
making mechanism for the establishment of alternate courses of action if 
the limit is violated. Using "Q" as an example and assuming a fuel quantity 
less than "Q" at departure time, the information required should at least 
include: 

a) A method for the verification of the actual quantity. 

b) A method to determine the cause of the low quantity. 

c) Possible corrective action once the cause is isolated. 

d) Time required for recovery. 

e) Effect of time delay on other systems. 

f) Alternative courses of action (can a refueling stop be made between 
“A" and "B"). 

g) Effect of alternative courses of action (if refueling stop can be 
made, what are the consequences). 

The above considerations regarding absolute value redlines assume that 
the worst consequences ensuing from a limit violation is the inhibition of 
the start of a process. Under such conditions, decisions as to what action 
is to be pursued are influenced primarily by the time and resources available 
for the determination of, and the recovery from, the cause of the redline 
violation. 

The second function controlled by the absolute value redline is usually 
related to specific performance limitations of elements within a process. 

This redline is characterized by the fact that a deliberate action is re- 
quired in order to produce a violation. The maximum cruising speed or altitude 
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of an aircraft are good examples of the application of this redline. If a 
limit is set for these parameters, their violation can only occur as a 
result of a direct and deliberate action. 

2.2.2 Time Dependent Redlines 

Time dependent redlines define the limit by which a parameter can deviate 
with respect to a nominal value during the performance of a process; both 
the limit and the parameter value vary as a function of time. This redline 
is used to control elements of an ongoing process whose performance is criti- 
cal to the overall operation. Violations of this redline are usually asso- 
ciated with irreversible failures that dictate an early process termination. 

One of the principal functions of time dependent redlines is that of 
anticipating and predicting, as early as possible, violations. This is required 
for the formulation and implementation of timely and effective recovery pro- 
cedures. This requires the continuous surveillance of the process and the 
performance of trend analysis of critical aspects of the operation. 

Figure 1 illustrates the time dependent redline concepts as they apply 
to the aircraft flying from point "A" to point "B" discussed earlier. As 
in the previous example (Section 2.2.1) the quantity of fuel required to 
perform the flight is "Q", which was also specified as the absolute value 
redline. Also note from Figure 1 that the value of "Q" includes the flight 
fuel requirements and a reserve quantity "q". 

The fuel depletion profile for the nominal flight is denoted by the QR 
line of Figure 1 such that if the flight is flown as planned, the aircraft 
will land with exactly the reserve quantity "q" in its storage tanks. 

The time dependent redline is defined by the line PS which marks the 
limit by which deviations are permitted from the nominal value QR. It 
should be noted that the area bounded by QRSP corresponds to the reserve 
fuel quantity included to account for expected inaccuracies and errors. 
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Figure 1. Time Dependent Redline 





Assume at some point "C" between "A" and "B" that a deviation (not a 
redline violation) from the nominal depletion QR is observed for the first 
time. The redline function is to advise the crew of the apparent deviation 
and to continue monitoring the fuel depletion rate. This process continues 
until a trend of the consumption rate deviation is established, and at some 
point "D" a projection is made of the fuel required to complete the flight 
at the deviated rate. Such projection will show that there is not enough 
fuel to complete the flight at the deviated consumption rate, and that the 
redline will be actually violated at point "E". 

With the above information at point "D", the decision process discussed 
in Section 2.2.1 can be initiated and the redline violation at point "E" 
avoided . 

Continuous monitoring and projection capabilities are essential elements 
of the time dependent redline function, to preclude the discovery at point 
"E" that the redline has been violated and that there is not enough fuel to 
complete the trip. 

2.3 REDLINE MONITORING 

An integral part of the redline specification process includes the 
measuring and monitoring mechanisms. Sensors, gauges, meters, and other 
display devices must be available to monitor the redline parameters. In- 
accuracies and probable errors of these devices must be considered along 
with instrumentation checks to filter out false redline violation indications. 

Priorities must be established for the selection of instrumentation 
including redundant, alternate, or backup monitoring for critical functions 
in the process. 

Monitoring of time dependent redlines should include the capability to 
compare the actual parameter value with those of the nominal and redline 
values. Depending on the observed differences, an assessment should be made 
of their short and long term impact on the progress of the process, thus 
providing timely advisories of potential problem situations. 
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2.4 REDLINE DEVELOPMENT 


Redline values correspond to the actual limit or condition imposed on 
a parameter that must be observed during the performance of a given process 
operation. These values are derived from evaluation of the capabilities and 
operating characteristics of a given mechanism, together with the process 
objectives and requirements. 

Specification of redline values is initiated by a detail analysis of 
the performance capabilities of a system in support of the given process. 

A failure mode and effects analysis is virtually required for every element 
of the process. The analysis should include operation of the system under 
nominal as well as under alternate conditions designed to simulate contin- 
gency situations. The following specific information must be made available 
along with the redline limit itself, which should specify the parameter's 
units, tolerance, frequency at which must be obtained, etc: 

a) The rationale and justification for the selection of the redline 
value including its relation to the general and particular aspects 
of the process. 

b) Instrumentation and monitor requirements, including expected errors 
induced by these elements in the establishment of the redline value. 

c) Alternate mechanisms for the verification of the instrumentation 
and monitor process information. 

d) Short and long term effects and consequences of redline violations 
to the overall process. 

e) Procedural steps for fault isolation if a redline violation is 
detected and verified, 

f) Special procedures to effect the repair of faults arising from red- 
line violations. 

g) Options available to proceed in case the redline violations occur 
from irreversible failures. 

Any and all of the above is intended to provide the means by which 
effective decisions can be made for the protection of life and equipment in 
case of redline violations. Any other information not listed here but 
deemed helpful for a particular situation should also be included. 
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3.0 REDLINES ON PAST SPACECRAFT PROGRAMS 

This section directs its attention to the redline development process 
of past manned spacecraft programs (Apollo, Skylab, ASTP) as it relates to 
consumables subsystems. An attempt to highlight the principal points of 
those processes has been made with a view toward the establishment of 
effective redline mechanisms for advanced spacecraft systems. 

During the early stages of the Apollo Program, beginning with the AS-504, 
AS-505 unmanned flights, redlines evolved from a comprehensive set of docu- 
ments, including: Mission Definition, Mission Requirements, Detail Test 
Objectives, Launch and Flight Rules, Flight Plan, etc. Guidelines for red- 
line development emerged from the detail evaluation of the mission objectives 
as postulated in the above documents, and the systems capabilities. The detail 
test objectives demanded a rigorous analysis of each subsystem and served in 
most cases as the basis for the establishment of the redline limits and 
the instrumentation and monitor requirements. 

The consumables subsystem redline development concepts employed during 
the Apollo Program, and subsequently used in the Skylab and ASTP Programs, 
are outlined in References 1 and 2. These redlines can be characterized 
as "absolute value redlines" in accordance with the definition given in 
Section 2.1.1. 

Consumables subsystem redlines, especially those for the lunar landing 
missions, were developed as "launch redlines". These redlines values speci- 
fied the minimum quantity of each of tfie various consumables that must be 
onboard prior to liftoff so that the launch could be effected. The particular 
values corresponded to the quantitites required to perform the mission as 
specified in the flight plan, plus any additional contingency requirements 
dictated in the launch and flight rules. 

Observance and implementation of the launch redlines were-successfully 
carried out with the support and cooperation of the Fluids Servicing Group 
at K5C. Tfn conjunction With this group { , a loading quantity was specified 
for each consumable used during pre-launch such that the- remaining quantity 
at liftoff? was equal to or greater than the redltne- value. 
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The unique aspects of space flight and the peculiar phases of the lunar 
missions made necessary the implementation of a comprehensive monitoring 
process. Each lunar mission was in effect a development flight. The varia- 
tion in lunar orbits, landing sites, and the different lunar stay periods 
demanded the implementation of tailor-made analysis, including the consumables 
redlines, for each flight. 

In addition to the launch operations, the redlines were of paramount 
significance during other phases of the flight where major commit decisions 
were required, such as the Translunar Injection and Lunar Landing Operations. 

Redline monitoring during flight was effected with the aid of spacecraft 
meters and quantity gauges onboard, and with the telemetry system at the 
Mission Control Center (MCC). The redline values were provided to the crew 
and flight control personnel by the Flight Crew and Console Charts, respectively , 
furnished by the Consumables Analysis Section (CAS) of the Mission Planning and 
Analysis Division (MPAD) that depicted the predicted pre-mission depletion 
profiles of the various consumables. Trend development and quantities re- 
maining projection during flight was strictly performed at the MCC by the 
Flight Control Crew with support of consumables specialists from CAS on a 
24 hours a day basis. Telemetry data would be plotted on the console charts 
at MCC to show the relation of the actual vs. the predicted quantities as 
the flight progressed. This process, when deviations Were noted, ®/as instru- 
mental in the correction of some flight procedures, and in tho enhancement of 
the consumables analysis process of subsequent missions, by %fie uso of actual 
flight data. 

The redline activities as outlined the preceding paragraphs were 
carried through and implemented in all Apollo flight and extended to the 
Skylab and ASTP flights as well. 


4.0 REDLINES ON FUTURE SPACECRAFT PROGRAMS 


Future manned spacecraft programs demand the development and implemen- 
tation of mission planning methods that are both responsive and cost effec- 
tive in the new operating environments. The projected flight density (50 
flights per year) for the operational Space Shuttle, for example, coupled with 
its hardware reuseability feature s make the streamlining and the efficient 
utilization of the available resources imperative to cope with these require- 
ments. 

New techniques, applicable to the Space Shuttle, are being developed to 
perform the consumables management function during the mission planning and 
operational phases of advanced spacecraft systems. This new methodology 
based on experience gained on past programs and during the developmental 
phase of the Space Shuttle flights emphasizes the simplification of the analy- 
sis process. The repetitive and routine nature of the operational Space 
Shuttle flights alsc suggest a requirement for the standardization of all as- 
pects of operations planning. Redline development should, in as much as it 
is practical, emerge also as a routine process. 

Redlines must fulfill the basic requirement of life and equipment pro- 
tection while maximizing the achievement of flight objectives. Using these 
criteria as a guide, the following considerations are presented for the 
development of consumables subsystem redlines for the operational Space Shuttle 
as an example of advanced spacecraft systems. 

Guidelines for the development of consumables subsystem redlines for 
the Space Shuttle must evolve from: 

• Analysis of the overall operational objectives and requirements of 
the program 

• The Space Shuttle systems capabilities 

• The availability of flight support resources. 

The exclusive earth orbit operational requirements of the Space Shuttle 
flights when contrasted with those of the lunar missions present new dimen- 
sions to be considered in the redline development. The consequences of 
consumables subsystem redline violations while on earth orbit, excluding 
catastrophic failures, at worst will necessitate an early flight termination 
which, due to replanning capabilities and reuseable spacecraft, may not ad- 
versely impact Space Shuttle operations. 
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Development of the Launch Processing System (LPS) at the launch site 
(KSC) for the servicing and checkout of the spacecraft during the prelaunch 
and launch operations requires the consumables subsystem redline functions 
to be attune with such mechanism. 

While some of the operational aspects of the Space Shuttle tend to sim- 
plify the role of the consumables subsystem redlines, others introduce new 
requirements that must be considered. The reuseable function of the Space 
Shuttle hardware, for example, requires that finite operational and shelf 
life, as well as performance degradation effects of some equipment, be in- 
cluded as part of the overall redline development process. This information, 
together with redline value updating to conform with observed flight data, 
must be introduced into the operating stream within the short turnaround 
period . 

4.1 LAUNCH REDLINES 

The function of the consumables subsystems launch redlines of the Space 
Shuttle correspond to that of the absolute value redline defined in Section 
2.2.1. Launch redlines define that minimum quantity of each subsystem con- 
sumable that must be available onboard before the Space Shuttle spacecraft 
can be launched. 

Each consumables subsystem launch redline value corresponds to the sum 
of two quantities: 

• The nominal mission requirements 

• The mission reserves. 

These quantities are illustrated in Figure 2 and generally can be defined* 
as follows: 


* Terms definitions taken from Reference 3. 
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l.a PRELAUNCH REQUIREMENTS 

1.0 NOMINAL 

l.b FLIGHT 

MISSION 

REQUIREMENTS 

REQUIREMENTS 



l.c POSTLANDING REQUIREMENTS 

2.0 MISSION 

2.b,c,d,e DISPERSIONS 

RESERVES 



2. a CONTINGENCY RESERVES 


Figure 2. Consumables Subsystem Launch Redline 
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1) Nominal mission requirements equal prelaunch requirements plus 
flight requirements plus postlanding requirements 

a) Prelaunch requirements - consumables required to be utilized 
from loading to launch 

b) Flight requirements - consumables r^uired to be utilized 
from launch to touchdown 

c) Postlanding requirement - consumables required to be utilized 
from touchdown to system shutdown. 

2) Reserves equal contingency reserves, dispersion allowance, flight 
planning uncertainty, measurement error (loading or in flight), 
and leakage. 

a) Contingency reserves - consumables required for specific system 
malfunctions and mission emergencies 

b) Dispersion allowance - consumables required to allow for system 
consumption rate fluctuations or performance capability varia- 
tions from the nominal 

c) Flight planning uncertainty - consumables allowed for mission 
planning purposes to compensate for unpredicted crew usage 

d) Measurement error equals loading error or in-flight measure- 
ment error 

o Loading error - consumables allowed for loading tempera- 
ture variations, ground measurement accuracy, system volume 
inaccuracy, and consumable density variations 

o In-flight measurement error - consumables which cannot be 
relied upon due to the inability to ascertain their presence 

e) Leakage - consumables defined by specification to be leaked 
from the system. 

The flight requirement should be the only variable quantity from mission 
to mission at the end of the developmental flights, when checkout of all Space 
Shuttle systems should be completed. 

Thus, specification of launch redline values for the operational Space 
Shuttle should correspond to the sum of constant quantities (the prelaunch, 
postlanding, and reserve requirements) and the variable flight requirements 
quantity. 
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Consideration of the repetitive nature of the Space Shuttle 
consumables kits availability, specific flight requirements (such as crew 
size, flight duration, propulsive maneuvers, payload support requirements , 
etc.) could lead to the establishment of a standard consumables quantity 
to support the flight requirements of most missions. This standard value, 
together with the constant quantity specified for the prelaunch, post- 
landing, and reserve requirements could be used to institute a "standard 
loading" philosophy for the launch redlines. 

Regardless of the method employed to determine the launch redline value, 
the magnitude of the actual onboard quantities require monitoring and veri- 
fication during the prelaunch and launch operations. This is required in 
order to detect potential redline violations and develop corrective measures 
as early as possible during the countdown. This monitoring function will be 
discussed further in Section 4.3. 

Since the loading and prelaunch operations will be under control of the 
LPS facility under development at KSC, the launch redline function must be 
integrated into that facility. This requirement will be addressed in Section 
4.3. 

4.2 FLIGHT REDLINES 

Consumables subsystems flight redlines functions for the Space Shuttle 
spacecraft are equivalent to the time dependent redlines defined in Section 
2.2.2. These redlines are designed for the protection of life and equipment 
during the performance of a process. The flight redlines function is initiated 
at liftoff and concludes at the completion of the rollout operations when 
control is transferred to the ground support equipment. 

The flight redline value for any subsystem consumable is that quantity 
that must be available onboard during orbital operations to effect an emer- 
gency deorbit and recovery of the crew and Space Shuttle. This absolute 
value corresponds to the contingency reserves quantity specified as item 
2. a in Section 4.1 . 

Continuous monitoring and processing of the flight redlines is required 
for two reasons: 
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1. To ensure that consumables depletion during flight are never allowed 
to reach the redline value 

To detect potential consumables redline violations as early as 
possible during the flight. 

The first condition can be readily satisfied by the comparison of the redline 
value with the available quantity onboard. This could be implemented through 
the caution «&nd warning system. 

Satisfaction of the second condition requires the continuous projection 
of end-of-mission quantities remaining, based on comparison of premission 
predicted Versus actual consumables values. 

4.3 REDLINE MONITORING 

The redline monitoring function of the time dependent redline discussed 
in Section 2.2.2 applies to both the prelaunch (launch redline) and flight 
(flight redline) operations of the Space Shuttle. Figure 3 illustrates this 
function. 

Quantity Q L corresponds to the total loading requirements which are 
equal to the nominal mission requirements plus the mission reserves. 

Quantities Q and q correspond to the launch and flight redline values 
respectively. 

The prelaunch requirement (line Q|_Qq ) includes the nominal prelaunch 
requirements (line Pj_Qq) and a prelaunch dispersions allowance (line Q L P [_)* 

Line Q l Q 1 corresponds to the nominal prelaunch depletion profile such that 
if the consumables depletion during prelaunch operations follows the planned 
rate, the Space Shuttle will have available at liftoff the excess quantity 
Q‘ = Q l P l . Line P^Q defines the prelaunch dispersions limit such that if the 
consumption rate during that period is equal to the nominal plus the allowable 
prelaunch dispersions, the quantity available at liftoff will be equal to Q, the 
launch redline value. 

The significance of the dispersion limit is that operation below these 
limits (shaded areas in Fig. 3) indicates an actual consumption rate exceeding 
the maximum allowed for nominal operations. Continued operation under this 
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Figure 3. Consumables Subsystem Redline Monitoring 
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condition will lead to a violation of the launch redline value, which can only 
be precluded by an equivalent consumption rate reduction resulting from modi- 
fications to the spacecraft configuration and/or the mission. 

Consider at some point A after the prelaunch operations are initiated 
that a deviation from the nominal depletion rate is detected. This deviated 
depletion rate, if allowed to continue, will fall below the dispersion limit 
line P^Q at point C and eventually violate the launch redline by falling to 
point D below the redline quantity Q at liftoff. The continuous redline 
monitoring and end-of-mission quantity remaining prediction function would have 
detected the deviated rate, established a trend at some point B and predicted 
at point C the imminent launch redline violation. This information is required 
prior to point C, as early as possible during the prelaunch operations, in order 
to maximize the recovery options. 

Another function of the redline monitor process is the updating of the 
liftoff quantity to the actual value available onboard. This quantity may 
be greater than Q, the launch redline value. 

Figure 3 also shows line QR as the depletion profile for the nominal 
flight, line PS as the flight disperions limit, and q as the flight redline 
value. Continuous monitoring is required during flight to detect potential 
flight redline violations. Three possible depletion rate deviations are 
shown occurring at point E which if allowed to continue will result in the 
reaching of the flight redline value at points H, I, or J. As in the prelaunch 
example, knowledge of the potential violation is required prior to pc' nt G 
to maximize the recovery options. 

Determination of the cause of the higher depletion rate is not only 
significant to effect recovery procedures during specific flights, but also 
to account for these effects on subsequent flights. 

4.4 AUTOMATED REDLINE MONITORING 

The redline monitoring function requires the processing of the onboard 
instrumentation to first verify observance of the launch redline values dur- 
ing prelaunch, and second, to project end-of-mission quantities remaining and 
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check for potential or actual launch or flight redline violations. This 
function was performed in past programs by the Fluids Servicing Group at KSC 
and the Flight Control Crew at the MCC at JSC, with direct support of consum- 
ables specialists from CAS. 

Consideration of the Space Shuttle requirements for the operational era, 
indicate the desirability for the development and implementation of routine auto- 
mated processing techniques for all aspects of mission planning and flight oper- 
ations, Evidence of this includes the development of the LPS complex at 
KSC for the automatic servicing, checkout, and launch of the Space Shuttle 
spacecraft. 

To provide redline support to the Space Shuttle operations it is recom- 
mended that the Redline Status Subprocessor or suitable equivalent be developed. 
This subprocessor forms a part of the Flight Operations Processor whose func- 
tional requirements are documented in Reference 4. 

The function of the Redline Status Subprocessor is to check the measured 
consumables parameters against predetermined limit values to establish viola- 
tions to the launch or flight redlines. Launch redline processing includes the 
comparison of the actual onboard quantities against the predetermined limit 
values, and the updating to the actual liftoff quantities. Flight redline 
processing includes, in addition to the comparison of predicted versus actual 
quantities, the projection of end-of-mission quantities remaining for the de- 
tection of potential redline violations. 

The Redline Status Subprocessor was designed for the processing of 
consumables subsystem redlines, i.e., the launch and mission dependent red- 
lines as part of the overall consumables management system, but its adapta- 
tion to handle mission independent redlines can be readily implemented. In 
addition, the algorithms are amenable for use in the MCC, adaptation to the 
LPS facility under development at KSC, or implementation in the Space Shuttle 
onboard computer system, as illustrated in Figure 4. 
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Figure 4. An Approach to Automated Monitoring of 
Consumables Subsystem Redlines 
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